Security News Remote Code Execution Vulnerability Disclosed in Windows JScript Component

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/remote-code-execution-vulnerability-disclosed-in-windows-jscript-component/

A vulnerability exists in the Windows operating system's JScript component that can allow an attacker to execute malicious code on a user's computer.


Responsible for discovering this bug is Dmitri Kaslov of Telspace Systems, who passed it along to Trend Micro's Zero-Day Initiative (ZDI), a project that intermediates the vulnerability disclosure process between independent researchers and larger companies.

ZDI experts reported the issue to Microsoft back in January, but Microsoft has yet to release a patch for this vulnerability. Yesterday, ZDI published a summary containing light technical details about the bug.

JScript bug leads to RCE

According to this summary, the vulnerability allows remote attackers to execute malicious code on users' PCs.

Because the vulnerability affects the JScript component (Microsoft custom implementation of JavaScript), the only condition is that the attacker must trick the user into accessing a malicious web page, or download and open a malicious JS file on the system (typically executed via the Windows Script Host —wscript.exe).
....
.....
...

Flaw does not lead to full system compromise

Gorenc told us the vulnerability is not as dangerous as it sounds, as it does not allow a full system compromise.

"The flaw only allows code execution within a sandboxed environment," Gorenc said. "An attacker would need additional exploits to escape the sandbox and execute their code on the target system."
The vulnerability has received a 6.8 rating out of 10 on the CVSSv2 severity scale, which is a pretty high score, when compared to most vulnerabilities.

Microsoft is working on a patch

According to Gorenc, a patch is coming. "To the best of our knowledge, Microsoft does still intend to release a fix for this bug. However, they did not complete the fix within the timelines set out in our disclosure policy."
...
....